CVE-2019-11445
CVSS v3
7.2
HIGH
EPSS Score
14.2 %
exploit probability, as of 2026-10-05
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.
Technical details
- Published
- 2019-04-22
- Exploit-DB
- EDB-46526
Frequently asked questions
What is CVE-2019-11445?
OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.
Is CVE-2019-11445 actively exploited?
Active exploitation of CVE-2019-11445 has not been confirmed. Its EPSS score was 14.2% on 2026-10-05, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2019-11445?
CVE-2019-11445 has a CVSS v3 base score of 7.2 (HIGH severity).
Is CVE-2019-11445 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 50 free checks/month · Free API key
Other 2019 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).